Matomo is the most obvious Google Analytics alternative — but out of the box it is not automatically banner-free. In its default state, Matomo sets cookies like any classic analytics tool. It becomes banner-free through four settings: disable tracking cookies, shorten IP addresses, respect Do Not Track, auto-delete old raw data. All four are built-in and set within half an hour. Let’s take them in order.
The usual frame: this is a technical guide, not legal advice. Whether your specific configuration may run consent-free belongs with your privacy counsel — and in your privacy policy either way.
Step 1: turn off tracking cookies
The most important switch sits in the tracking code: _paq.push(['disableCookies']) before the tracker call, and Matomo works entirely without cookies. That removes the device access which triggers consent under § 25 TDDDG — the foundation of the whole banner-free model. The price is known: returning visitors can no longer be recognised across long periods, and the “returning vs. new” metric loses precision. For a company site that wants to know what gets read and where visitors come from, nothing relevant changes.
Step 2: shorten IP addresses
In the UI under Administration → Privacy → “Anonymize data”: enable IP anonymisation and mask at least two bytes. A full address becomes a network range — entirely sufficient for statistics, useless for identifying individual people. While you’re there, you can also de-fang referrer parameters and location precision.
Step 3: respect Do Not Track and set retention
Two more checkboxes in the same privacy area. First: respect “Do Not Track” — visitors whose browser sends the signal aren’t counted at all. Second: enable automatic deletion of old raw data and set a period; the aggregated reports survive, the detailed visit data disappears on schedule. That also answers the question every record of processing asks: how long do you keep this?
What belongs in the privacy policy
Banner-free doesn’t mean you can skip the privacy policy. It needs to say that you run Matomo self-hosted and cookieless, that IPs are shortened, on which legal basis you measure (in this configuration usually legitimate interest) and how long raw data is retained. That’s a paragraph, not a chapter — but it has to be there before the tracker goes live.
Operations decide — as always
Self-hosted Matomo is the most consistent option: not a single byte of visitor data leaves the house. It is also one more service that needs updates, backups and monitoring — which is exactly where self-hosting projects fail, not at the software. An unmaintained analytics instance full of visitor data is a worse state than no statistics at all. If you want the data control without the operational load, run Matomo as a managed service — someone looks after the instance, and the data still sits on EU servers under your control.
Want Matomo set up cookieless — or have it set up — with the privacy policy sorted in the same pass? Get in touch — it’s a contained project with a clear end.